CVE-2022-1426

LOW

GitLab 12.6-14.8.5, 14.9-14.9.3, 14.10 - Improper Authentication

Title source: llm
STIX 2.1

Description

An issue has been discovered in GitLab affecting all versions starting from 12.6 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly authenticating a user that had some certain amount of information which allowed an user to authenticate without a personal access token.

References (3)

Core 3
Core References
Permissions Required, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/1070097

Scores

CVSS v3 2.0
EPSS 0.0020
EPSS Percentile 41.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Details

CWE
CWE-287
Status published
Products (2)
gitlab/gitlab 14.10.0 (2 CPE variants)
gitlab/gitlab 12.6.0 - 14.8.6 (2 CPE variants)
Published May 11, 2022
Tracked Since Feb 18, 2026